Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
  • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
  • G06F21/40—User authentication by quorum, i.e. whereby two or more security principals are required
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
  • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2113—Multi-level security, e.g. mandatory access control
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2145—Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
  • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
  • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
  • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
  • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Definitions

• the present invention relates generally to the field of software systems, and in particular to multi-user log in to such software systems.
• Permissions may for example be granted based on the work description of the particular user.
• an administrator could be permitted to access all information and perform any action in the system
• a human resource representative should be permitted to perform personnel tasks and view salaries and similar matters
• an employee at a finance department should be permitted to access financial records and make budget reports
• a visitor or guest may be permitted to have only a read-only access to information and no access at all to sensitive information etc.
• Another way of solving the work task could be to create a new special user with a login having the combined permissions needed to perform the work task.
• To create such special user permissions each time a work task requires the permissions of different user categories is also very inefficient and most likely also needing an administrator creating the special user login.
• a method for setting up an access level for use of a software system comprising different levels of user accesses.
• the method comprises the steps of: using a first user login to log in to the software system, the first user login having a first access level comprising a first set of permissions; using a second user login to log in to the software system, the second user login having a second access level comprising a second set of permissions; and combining the permissions of the first set of permissions and the second set of permissions in the software system, thereby setting up the access level for the use of the software system, the access level comprising the combined permissions of the first set of permissions and the second set of permissions.
• the first user login comprises using a first user name and a first password
• the second user login comprises using a second user name and a second password.
• a login procedure that the users are accustomed to may be used.
• the first user login and the second user login comprises using a respective identification card or a biometric authentication device.
• the method comprises a further step of, after completion of the step of using a first user login, clicking on a button to thereby make available a login procedure for the step of using a second user login.
• a rapid way of providing the desired access level is thereby enabled, and this can further be easily implemented.
• the software system comprises one of: an operative system of a computer, a control system for controlling a power plant, a control system for controlling a process, an economy program. Numerous of users of different software systems may thus benefit from the present invention .
• the first set of permissions comprises access to a first set of computer programs and/or information
• the second set of permissions comprises access to a second set of computer programs and/or information
• the step of combining the permissions of the first set of permissions and the second set of permissions in the software system comprises taking the union thereof.
• the combined access levels comprising the first and second set of permissions can now be accessed simultaneously by the first and second user.
• the set of permissions comprises permission levels within a particular computer program .
• the invention also encompasses computer program products and processor devices.
• Figure 1 illustrates a computer and a display unit.
• Figure 2 illustrates a flow chart over steps of a method in accordance with an embodiment .
• Figure 3 illustrates different sets of permissions.
• Figure 4 illustrates a computer program and computer program product of the computer of figure 1.
• the present invention provides a method for allowing multiple, simultaneous logins, with a permission level that is a combination of the permissions of all participants.
• Figure 1 illustrates a display unit 1 connected to a computer 2.
• the display unit 1 has a screen showing a screen view comprising a user login means 3.
• the computer 2 may also be connected to or comprise an input device 23, such as a keyboard.
• a first user logs in to an operative system of the computer 2 by entering his user name and password using the input device 23.
• the first user has a first access level including a first set of permissions.
• the first set of permissions may for example comprise the use of two particular programs, program A and program B, installed on the computer 2 or in some other available through the operative system.
• a second user then logs in to the same operative system of the same computer 2 by entering his user name and password.
• the second user has a second access level including a second set of permissions.
• the second set of permissions may for example comprise the use of program A and program C.
• the set of permissions may comprise the permission levels within a particular program D.
• the first user may have the permission only to add information, while the second user has the permission to add information, to delete information and to change information.
• Such permission levels within a program may comprise any type of operations performed within the program, obviously depending on the program in question.
• the read, write, delete example above being only an example thereof.
• the first and second users are then both logged in to the operative system with their respective sets of permissions now available simultaneously.
• the first and second users now have access to programs A, B and C and may cooperate in order to solve a particular work task.
• the user login means 3 is just used as an exemplifying illustration.
• the users may use any login procedure, for example using biometric authentication such as using fingerprints, eye or face recognition as the login procedure.
• Yet another example comprises the use of identity cards. It is thus realized that several alternative login procedures can be used.
• the login procedure of the second user comprises, in an embodiment of the invention, clicking on a dedicated login button in order to get a login window in which he may enter his user name and password.
• a button in the start menu e.g. a button defining "Log in further user”
• Buttons in a toolbar of a computer program is yet another example.
• the users log in by using identification cards then the simple act of each user e.g. passing their respective identification cards through a reader/authentication device would suffice.
• a fingerprint scanner device is used for login, and each user then just uses the scanner device in order to log in .
• a method is presented for setting up an access level for use of a software system.
• the software system comprises different levels of user accesses.
• the method 10 comprises a first step 11 of using a first user login to log in to the software system, wherein the first user login has a first access level comprising a first set of permissions.
• the method 10 comprises a second step 12 of using a second user login to log in to the software system, wherein the second user login has a second access level comprising a second set of permissions.
• the method 10 comprises the third step 13 of combining the permissions of the first set of permissions and the second set of permissions in the software system.
• the desired access level for the use of the software system is set up, wherein the desired access level comprises the combined permissions of the first set of permissions and the second set of permissions.
• the first user login comprises using a first user name and a first password
• the second user login comprises using a second user name and a second password.
• the method comprises a step of, after completion of the step of using a first user login, clicking on a button to thereby make available a login procedure for the step of using a second user login. That is, as soon as the first user has logged in to the software system, he or she may press a button and thereby enable a second user to repeat the log in procedure using his or hers login details. A rapid and easily implemented way of providing the desired access level is thereby enabled. In particular, the function of providing a login procedure by pressing a particular button may easily be programmed and thus implemented.
• Examples of software systems which the multiple users may be logged in to comprise: an operative system of a computer; a control system for supervising and controlling a power plant, a process industry or the like; an economy software program comprising different user access levels; an e-mail and/or calendar program; Software Configuration Management systems; document database; information database; websites and/or single webpages accessible through for example Internet or a local area network. It is realized that the invention may be implemented in and/or for any software system requiring authentication, e.g. by means of a login procedure requiring user name and password.
• the software system further comprises different access levels, for example meaning that different users have access to different sets of permissions, e.g. access to different programs or different information.
• the first set of permissions comprises access to a first set of computer programs and/or information
• the second set of permissions comprises access to a second set of computer programs and/or information
• the set of permissions comprises permission levels within a particular computer program. That is, the first user has a first set of permissions comprising particular permission levels (access levels) within a program (e.g. permission to read, write, alter, delete information) . The second user has a second set of permissions comprising particular permission levels within the same program (e.g. permission only to read information) .
• the step of combining the permissions of the first set of permissions and the second set of permissions in the software system comprises taking the union thereof. This will be described more in detail in the following .
• An algorithm to determine the combined permission level comprises taking the union of all permissions contributed by the logged in participants.
• the union of a collection of sets is the set of all distinct elements in the collection. If for example user A has a set of permissions comprising ⁇ 1, 2 ⁇ and user B has a set of permissions comprising ⁇ 3, 4 ⁇ , the effective permission level of the system when both A and B are logged in would be ⁇ 1, 2, 3, 4 ⁇ . If user C also logs in, having a set of permissions comprising ⁇ 2, 3, 5 ⁇ , then the effective permission level would be ⁇ 1, 2, 3, 4, 5 ⁇ . With reference now to figure 3, a second example of the above is illustrated. User A has permissions 1, 2, user B has permissions 3, 4 and user C has permissions 4, 5, 6. If user A and user B both logs in having their respective permissions, the combined permissions would be 1, 2, 3, 4. If user B and user C logs in, their combined permissions would comprise 3, 4, 5, 6.
• multiple users can simultaneously access a control system used for controlling a power plant, e.g. SCADA (Supervisory Control And Data Acquisition) .
• SCADA Supervisory Control And Data Acquisition
• SCADA Supervisory Control And Data Acquisition
• both a human resource representative and a controller from a finance department are working on a task, they can both log in and the software system grants them access to both human resource information as well as finance information at the same time.
• a number of users may log in to the same software system using their own login details (e.g. user name and password) . They may thereby work more effectively in order to rapidly, and in particular much faster than in known prior art methods, solve their work tasks.
• the invention allows users to work in a collaborative manner in order to achieve results. Many software solutions have a strong requirement on user authentication and authorization and could benefit from the more flexible login system provided by the present invention .
• the invention also encompasses a computer program product 4 for setting up an access level for use of the software system comprising different levels of user accesses.
• the computer program product 4 comprises computer readable means carrying computer program code, the program code being configured to: - accept a first user login to log in to the software system, the first user login having a first access level comprising a first set of permissions,
• the access level comprising the combined permissions of the first set of permissions and the second set of permissions.
• the corresponding set of permissions is retrieved, and when combining the permissions the union thereof is preferably provided.
• the permissions for the logged in person are retrieved from e.g. a software program.
• This software program could comprise program code of the software system which the person is logging into, or it could comprise a separate software program.
• the permissions for the logged in person have been entered beforehand, in conventional manner.
• the invention further encompasses a processor device, for example the computer 2, for setting up an access level for use of the software system comprising different levels of user accesses.
• the processor device 2 comprises means for carrying out the method as described earlier.
• the setting up of an access level can be implemented as program code within the control software system.
• the setting up an access level for use of a software system comprising different levels of user accesses can thus be implemented as a program module 22 of a computer program 21 comprising code means which when run by a processor 24 in the computer 2 causes the computer 2 to perform the above-described functions and actions.
• the program module 22 can be implemented as a program module of the computer program 21 comprising code means which when run by the processor 24 causes the computer 2 to perform the above-described functions and actions.
• the processor 24 is typically able to receive user input from the input device 23, for example user log in particularities input by the user.
• the input device 23 may be the earlier mentioned keyboard or some other input device such as a card reader .
• the processor 24 may be a single CPU (central processing unit), but could comprise two or more processing units in the computer 2.
• the processor 24 may comprise general purpose microprocessors, instruction set processors and/or related chips sets and/or special purpose microprocessors, such as ASICs (application specific integrated circuits) .
• the processor 24 may also comprise board memory for caching purposes.
• the computer program 21 may be carried by a computer program product 20 in the computer 2 connected to the processor 24.
• the computer program product 20 comprises a computer readable medium on which the computer program 21 is stored.
• the computer program product 20 may be a flash memory, a RAM (Random-access memory) , ROM (Read-Only memory) or an EEPROM (Electrically Erasable Programmable ROM) , and the computer program modules described above could in alternative embodiments be distributed on different computer program products in the form of memories within the computer 2.
• the computer program product 20 may an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu-Ray disc.
• the computer program 21 for setting up an access level for use of a software system comprising different levels of user accesses comprises computer program code (e.g. program module 22) which when run on the processor 24 of the computer 2 causes the computer 2 to: accept a first user login to log in to the software system, the first user login having a first access level comprising a first set of permissions; accept a second user login to login to the software system, the second user login having a second set of permissions; and combine the permissions of the first set of permissions and the second set of permissions in the software system, thereby setting up the access level p for the use of the software system, the access level comprising the combined permissions of the first set of permissions and the second set of permissions.
• the invention is not restricted to a particular number of users logging in to the software system. Although the invention has been described using only a few number of users, any number of users can be logged into the software system, for example several hundred users or thousands .

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• Software Systems (AREA)
• Computer Hardware Design (AREA)
• Databases & Information Systems (AREA)
• Health & Medical Sciences (AREA)
• Bioethics (AREA)
• General Health & Medical Sciences (AREA)
• Storage Device Security (AREA)
• Safety Devices In Control Systems (AREA)

Priority Applications (2)

Applications Claiming Priority (4)

Related Child Applications (1)

Publications (1)

Family

ID=44117434

Family Applications (1)

Country Status (4)

Families Citing this family (15)

Citations (1)

Family Cites Families (13)

• 2011
  • 2011-04-06 EP EP11161349.3A patent/EP2450818B1/de active Active
  • 2011-10-31 WO PCT/EP2011/069093 patent/WO2012062614A1/en active Application Filing
  • 2011-10-31 CN CN201180053713.9A patent/CN103201745B/zh active Active
• 2013
  • 2013-05-06 US US13/888,004 patent/US9239914B2/en active Active

Patent Citations (1)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events